CRI-O v1.34.0
The release notes have been generated for the commit range
v1.33.0…259e23f on Wed, 20 Aug 2025 07:47:13 UTC.
Downloads
Download one of our static release bundles via our Google Cloud Bucket:
To verify the artifact signatures via cosign, run:
> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.259e23fd4353e67b59b33a0457202210f40322ec.tar.gz \
--certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-repository cri-o/packaging \
--certificate-github-workflow-ref refs/heads/main \
--signature cri-o.amd64.259e23fd4353e67b59b33a0457202210f40322ec.tar.gz.sig \
--certificate cri-o.amd64.259e23fd4353e67b59b33a0457202210f40322ec.tar.gz.cert
To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:
> tar xfz cri-o.amd64.259e23fd4353e67b59b33a0457202210f40322ec.tar.gz
> bom validate -e cri-o.amd64.259e23fd4353e67b59b33a0457202210f40322ec.tar.gz.spdx -d cri-o
Changelog since v1.33.0
Changes by Kind
Dependency-Change
- Updated pause image to 3.10.1. (#9339, @saschagrunert)
Other
- Log additional container information when stopping container. (#9302, @bitoku)
Deprecation
- Deprecate
insecure_registries config. (#9278, @bitoku)
API Change
- Add HostNetwork field to the
/info endpoint to inform cadvisor whether a container is in the host network or not. (#9411, @haircommander)
Feature
- Added HugeTLB usage (
container_hugetlb_usage_bytes) and maxUsage (container_hugetlb_max_usage_bytes) metrics. (#9257, @gavinkflam)
- Added
exec_cpu_affinity type which can specify cpu where exec command runs. (#9286, @bitoku)
- Added container processes (
container_processes) metric. (#9366, @gavinkflam)
- Added feature to track conmon processes and emit containers_stopped_monitor_count{name=”$ctr_name”} metric when it’s stopped. (#9205, @bitoku)
- Added feature to track conmon-rs processes and emit containers_stopped_monitor_count{name=”$ctr_name”} metric when it’s stopped. (#9348, @bitoku)
- Added support for conmon-rs streaming server on
Exec and Attach. To enable it, set
stream_websockets = true as part of the runtime handler configuration. (#9289, @saschagrunert)
- Early pre-validate the configured pod runtime (
conmon-rs) on config validation. (#9324, @saschagrunert)
Documentation
- Fixed typos in CLI and error messages.
- Deprecated
CONTAINER_INCLUDED_POD_METRCIS CLI environment variable in favor of CONTAINER_INCLUDED_POD_METRICS. (#9299, @saschagrunert)
- Updated tracing docs to use the latest jaeger image as well as simplify the configuration. (#9342, @saschagrunert)
Bug or Regression
- Fix a bug where CRI-O did not respect cases where the kubelet instructed it to unmask /proc for containers (#9285, @haircommander)
- Fix a potential deadlock when an infra container is taking a long time to exit and the sandbox’s readiness is blocked on the infra container’s opLock (#9188, @haircommander)
- Fix terminal resize race condition (#9246, @sohankunkerkar)
- Fix the bug that pod can’t be terminated when the process is uninterruptible sleep for a while. (#9256, @bitoku)
- Fix the bug where it continues to emit a metric after it confirms the conmon is stopped once (#9333, @bitoku)
- Fixed a bug which caused CDI injection by NRI plugins to not being honored. NRI plugins are now able to inject CDI devices into containers. (#9128, @klihub)
- Fixed segmentation fault when trying to create a lot of pods at a time. (#9272, @bitoku)
- Fixes a crash introduced in 1.33.0 when cleaning up a pod that uses HostPorts
on a system that has either just iptables (but not nftables) or just nftables
(but not iptables). (#9222, @danwinship)
- Handle missing network namespace gracefully during networkStop (#9301, @sohankunkerkar)
- Server: add real-time memory validation for limit updates (#9385, @sohankunkerkar)
- Server: delay CDI device injection, to ensure that CDI Spec edits take precedence over image defaults and the Pod Spec. (#9292, @klihub)
- Server: ensure CNI teardown prevents IP leaks with missing netns (#9372, @sohankunkerkar)
Dependencies
Added
- github.com/alibabacloud-go/tea-utils/v2: v2.0.7
- github.com/cenkalti/backoff/v5: v5.0.2
- github.com/go-piv/piv-go/v2: v2.3.0
- github.com/go-viper/mapstructure/v2: v2.3.0
- github.com/google/go-github/v72: v72.0.0
- github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1
- github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0
- github.com/moby/sys/atomicwriter: v0.1.0
- github.com/olekukonko/errors: v1.1.0
- github.com/olekukonko/ll: v0.0.9
- github.com/olekukonko/ts: 78ecb04
- github.com/redis/go-redis/extra/rediscmd/v9: v9.5.3
- github.com/redis/go-redis/extra/redisotel/v9: v9.5.3
- gitlab.com/gitlab-org/api/client-go: v0.127.0
- go.etcd.io/raft/v3: v3.6.0
- go.yaml.in/yaml/v2: v2.4.2
- go.yaml.in/yaml/v3: v3.0.4
- sigs.k8s.io/structured-merge-diff/v6: v6.2.0
Changed
Removed
- cloud.google.com/go/profiler: v0.4.2
- cloud.google.com/go/storage: v1.50.0
- github.com/14rcole/gopopulate: b175b21
- github.com/AdamKorcz/go-fuzz-headers-1: 8b5d3ce
- github.com/DATA-DOG/go-sqlmock: v1.5.2
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric: v0.49.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping: v0.49.0
- github.com/alessio/shellescape: v1.4.1
- github.com/aws/aws-sdk-go-v2/feature/s3/manager: v1.17.10
- github.com/cavaliercoder/badio: ce52801
- github.com/cavaliercoder/go-rpm: 8cb9fd9
- github.com/cavaliergopher/cpio: v1.0.1
- github.com/go-piv/piv-go: v1.11.0
- github.com/go-redis/redismock/v9: v9.2.0
- github.com/google/go-github/v60: v60.0.0
- github.com/google/rpmpack: v0.6.0
- github.com/google/trillian: v1.7.1
- github.com/google/wire: v0.6.0
- github.com/grpc-ecosystem/grpc-gateway: v1.16.0
- github.com/howeyc/gopass: c8aef6f
- github.com/imdario/mergo: v0.3.16
- github.com/jmoiron/sqlx: v1.4.0
- github.com/ostreedev/ostree-go: 719684c
- github.com/sassoftware/relic/v7: v7.6.2
- github.com/xanzy/go-gitlab: v0.109.0
- github.com/zalando/go-keyring: v0.2.3
- go.etcd.io/etcd/client/v2: v2.305.21
- go.etcd.io/etcd/raft/v3: v3.5.21
- gocloud.dev: v0.40.0
- software.sslmate.com/src/go-pkcs12: v0.4.0